Loading...

Microsoft Defender for Office 365: Modernization of AIR platform for user submission investigation playbook

Microsoft Defender for Office 365: Modernization of AIR platform for user submission investigation playbook

Microsoft Defender for Office 365 Plan 2+ is upgrading its Automated Investigations and Response (AIR) platform, starting with the user submission playbook, to improve speed and scalability. Rollout begins October 2025, with faster investigations, no downtime, unchanged workflows, and no admin action required. Applies to Defender for Office 365 Plan 2 or above customers: We’re rolling out a major upgrade to the Automated Investigations and Response (AIR) capability in Microsoft Defender for Office 365. One of the key areas of feedback from customers has been latency in AIR’s automated investigations—particularly in the user submission investigation playbook, where fast and reliable automation is essential to reducing Security Operations Center (SOC) workload and enabling focus on higher-severity incidents. In response to this feedback and as part of ongoing efforts to improve the end-to-end email submission response workflow in Defender for Office 365, AIR is being migrated from a legacy platform to a modernized infrastructure to improve performance, scalability, and speed. In this first phase, the user submission playbook (triggered by the alert policy “Email reported by user as malware or phish”) will be migrated. A separate communication will follow for the migration of other playbooks. This message is associated with Microsoft 365 Roadmap ID 503108. When this will happen: General Availability (Worldwide, GCC, GCCH, and DoD): Rollout begins in early October 2025 and completes by late December 2025. How this affects your organization: Who is affected: Organizations using Microsoft Defender for Office 365 with Automated Investigations and Response (AIR) enabled, specifically those leveraging the user submission investigation playbook. What will happen: AIR investigations for user submissions will complete in minutes instead of hours, even during surge loads. AIR is rebuilt on Microsoft Azure for flexibility and improved tenant-level isolation and load distribution. The modernized platform enables faster development and deployment of new AIR features. No disruptions or downtime during rollout. User workflows remain unchanged. This change is enabled by default. What you can do to prepare: No admin action is required before rollout. Review your current AIR configuration to assess impact. Notify users and update internal documentation if needed. Learn more: Automated […]

The post Microsoft Defender for Office 365: Modernization of AIR platform for user submission investigation playbook appeared first on M365 Admin.

Published on:

Learn more
Need help with this product?

We can help you with Microsoft Defender for Office 365: Modernization of AIR platform for user submission investigation playbook

If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.

M365 Admin
M365 Admin

by João Ferreira

Share post:

Related posts

Dynamics 365 Contact Center – Manage overnight shifts as a single continuous schedule

We are announcing the ability to manage overnight shifts as a single continuous schedule in Dynamics 365 Contact Center. This feature will rea...

2 hours ago

Manage who can upload advanced agents and plugins

Starting September 25, Microsoft 365 admins can control who uploads advanced Copilot agents and plugins, limiting access to specific users or ...

2 hours ago

Microsoft 365 Copilot: Insights Copilot Analytics cowork adoption impact

Microsoft 365 Copilot now includes Cowork adoption and impact insights in the Consumption dashboard and Viva Insights Advanced Insights. Avail...

2 hours ago

Writing Blocks in M365 Copilot

Microsoft 365 Copilot will introduce Writing blocks by mid-September 2026, enabling users to create and refine longer-form content like emails...

2 hours ago

Outlook: Change the organizer of meetings

Microsoft is introducing a feature to change the organizer of eligible Outlook meetings, allowing transfer of meeting ownership within an orga...

2 hours ago

Code Blocks in M365 Copilot

Microsoft 365 Copilot will support inline previews of code blocks, charts, and diagrams within conversations, eliminating the need for a separ...

2 hours ago

Microsoft SharePoint: PowerShell support for brand fonts deletion

Microsoft SharePoint will introduce the Remove-SPOFontFile PowerShell cmdlet by mid-October 2026, allowing admins to delete brand fonts across...

2 hours ago

[Outlook Mobile] Purview Data Loss Prevention support for Calendar Events

Outlook for iOS and Android will support Microsoft Purview Data Loss Prevention for calendar events, helping prevent sensitive data sharing in...

2 hours ago

[Outlook Mac] Purview Data Loss Prevention support for Calendar Events

Outlook for Mac will support Microsoft Purview Data Loss Prevention for calendar events, detecting sensitive info in meeting details to preven...

2 hours ago

[Outlook Mobile] Purview DLP Wait-on-Send Support

Outlook for iOS and Android will support Microsoft Purview DLP wait-on-send policies, allowing organizations to require and configure a wait t...

2 hours ago

Newsletter

Get the latest Dynamics 365 and Power Platform content in your inbox

A curated digest of community blogs, product news, videos, and podcasts — delivered without the noise.

Weekly updates Unsubscribe anytime Fresh community picks
We use your email only for the newsletter and you can unsubscribe at any time.
By subscribing, you agree to the privacy policy.